Notice2023-06645
Agency Information Collection Activities; Submission to the Office of Management and Budget (OMB) for Review and Approval; Comment Request; Self-Certifications Under the Data Privacy Framework Program
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
March 30, 2023
Issuing agencies
Commerce DepartmentInternational Trade Administration
Abstract
The Department of Commerce, in accordance with the Paperwork Reduction Act of 1995 (PRA), invites the general public and other Federal agencies to comment on proposed, and continuing information collections, which helps us assess the impact of our information collection requirements and minimize the public's reporting burden. The purpose of this notice is to allow for 60 days of public comment preceding submission of the collection to OMB.
Full Text
<html>
<head>
<title>Federal Register, Volume 88 Issue 61 (Thursday, March 30, 2023)</title>
</head>
<body><pre>
[Federal Register Volume 88, Number 61 (Thursday, March 30, 2023)]
[Notices]
[Pages 19067-19069]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2023-06645]
-----------------------------------------------------------------------
DEPARTMENT OF COMMERCE
International Trade Administration
Agency Information Collection Activities; Submission to the
Office of Management and Budget (OMB) for Review and Approval; Comment
Request; Self-Certifications Under the Data Privacy Framework Program
AGENCY: International Trade Administration, Department of Commerce.
ACTION: Notice of information collection, request for comment.
-----------------------------------------------------------------------
SUMMARY: The Department of Commerce, in accordance with the Paperwork
Reduction Act of 1995 (PRA), invites the general public and other
Federal agencies to comment on proposed, and continuing information
collections, which helps us assess the impact of our information
collection requirements and minimize the public's reporting burden. The
purpose of this notice is to allow for 60 days of public comment
preceding submission of the collection to OMB.
DATES: To ensure consideration, comments regarding this proposed
information collection must be received on or before May 30, 2023.
ADDRESSES: Interested persons are invited to submit written comments to
Leo Kim, ITA Paperwork Clearance Officer, International Trade
Administration, Department of Commerce, Room 23016RA, 14th and
Constitution Avenue NW, Washington, DC 20230 (or via the internet at
<a href="/cdn-cgi/l/email-protection#c4949685a7aba9a9a1aab084a0aba7eaa3abb2"><span class="__cf_email__" data-cfemail="f7a7a5b694989a9a929983b7939894d9909881">[email protected]</span></a>). Do not submit Confidential Business Information or
otherwise sensitive or protected information.
FOR FURTHER INFORMATION CONTACT: Requests for additional information or
specific questions related to collection activities should be directed
to David Ritchie, Senior Policy Advisor, International Trade
Administration, Department of Commerce via email at
<a href="/cdn-cgi/l/email-protection#a1c5d1c78fd1d3cec6d3c0cce1d5d3c0c5c48fc6ced7"><span class="__cf_email__" data-cfemail="254155430b55574a425744486551574441400b424a53">[email protected]</span></a>, or by telephone at 202-482-1512.
SUPPLEMENTARY INFORMATION:
I. Abstract
The United States, the European Union (EU), the United Kingdom
(UK), and Switzerland share a commitment to enhancing privacy
protection, the rule of law, and a recognition of the importance of
transatlantic data flows to our respective citizens, economies, and
societies, but take different approaches to doing so. Given those
differences, the Department of Commerce (DOC) developed the EU-U.S.
Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S.
Data Privacy Framework (UK Extension to the EU-U.S. DPF), and the
Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) in consultation with
the European Commission, the UK Government, the Swiss Federal
Administration, industry, and other stakeholders. These arrangements
were respectively developed to provide U.S. organizations reliable
mechanisms for personal data transfers to the United States from the
European Union, the United Kingdom, and Switzerland while ensuring data
protection that is consistent with EU, UK, and Swiss law.
The DOC is issuing the EU-U.S. DPF Principles and the Swiss-U.S.
DPF Principles, including the respective sets of Supplemental
Principles (collectively the Principles) and Annex I of the Principles,
as well as the UK Extension to the EU-U.S. DPF under its statutory
authority to foster, promote, and develop international commerce (15
U.S.C. 1512). The International Trade Administration (ITA) will
administer and supervise the Data Privacy Framework program, including
maintaining and making publicly available the Data Privacy Framework
List, an authoritative list of U.S. organizations that have self-
certified to the DOC and declared their commitment to adhere to the
Principles pursuant to the EU-U.S. DPF and, as applicable, the UK
Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF. On the basis
of the Principles, Executive Order 14086, 28 CFR part 201, and
accompanying letters and materials, including ITA's commitments
regarding the administration and supervision of the Data Privacy
Framework program, it is the DOC's expectation that the European
Commission, the UK Government, and the Swiss Federal Administration
will respectively recognize the adequacy of the protection provided by
the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-
U.S. DPF thereby enabling personal data transfers from each respective
jurisdiction to U.S. organizations participating in the relevant part
of the Data Privacy Framework program. The EU-U.S. DPF,
[[Page 19068]]
the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF will not
enter into effect until they have respectively received such
recognition (i.e., until such formal recognition enters into effect).
In order to participate in the EU-U.S. DPF and, as applicable, the
UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF an
organization must (a) be subject to the investigatory and enforcement
powers of the Federal Trade Commission (FTC), the Department of
Transportation (DOT), or another statutory body that will effectively
ensure compliance with the Principles; (b) publicly declare its
commitment to comply with the Principles; (c) publicly disclose its
privacy policies in line with the Principles; and (d) fully implement
them.
While the decision by an organization to self-certify its
compliance pursuant to the EU-U.S. DPF and, as applicable, the UK
Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF and by
extension participate in the Data Privacy Framework program is
voluntary; effective compliance is compulsory: organizations that self-
certify to the DOC and publicly declare their commitment to adhere to
the Principles must comply fully with the Principles. Organizations
that only wish to self-certify their compliance pursuant to the EU-U.S.
DPF and/or the Swiss-U.S. DPF may do so; however, organizations that
wish to participate in the UK Extension to the EU-U.S. DPF must
participate in the EU-U.S. DPF. Such organizations' commitment to
comply with the Principles with regard to transfers of personal data
from the European Union and, as applicable, the United Kingdom, and/or
Switzerland must be reflected in their self-certification submissions
to the DOC, and in their privacy policies. An organization's failure to
comply with the Principles after its self-certification is enforceable
by the FTC under Section 5 of the Federal Trade Commission (FTC) Act
prohibiting unfair or deceptive acts in or affecting commerce (15
U.S.C. 45); by the DOT under 49 U.S.C. 41712 prohibiting a carrier or
ticket agent from engaging in an unfair or deceptive practice in air
transportation or the sale of air transportation; or under other laws
or regulations prohibiting such acts.
To rely on the EU-U.S. DPF and, as applicable, the UK Extension to
the EU-U.S. DPF, and/or the Swiss-U.S. DPF for transfers of personal
data from the European Union and, as applicable, the United Kingdom,
and/or Switzerland an organization must self-certify its adherence to
the Principles to the DOC, and both be placed and remain on the Data
Privacy Framework List. The DOC will update the Data Privacy Framework
List on the basis of annual re-certification submissions made by
participating organizations and by removing organizations when they
voluntarily withdraw, fail to complete the annual re-certification in
accordance with the DOC's procedures, or are found to persistently fail
to comply. The DOC will also maintain and make available to the public
an authoritative record of U.S. organizations that have been removed
from the Data Privacy Framework List and will identify the reason each
organization was removed. The aforementioned authoritative list and
record will remain available to the public on the DOC's Data Privacy
Framework program website. Any organization removed from the Data
Privacy Framework List must cease making claims that it participates in
or complies with the EU-U.S. DPF and, as applicable, the UK Extension
to the EU-U.S. DPF, and/or the Swiss-U.S. DPF and that it may receive
personal information pursuant to same. Such an organization must
nevertheless continue to apply the Principles to such personal
information that it received while it participated in the EU-U.S. DPF
and, as applicable, the UK Extension to the EU-U.S. DPF, and/or the
Swiss-U.S. DPF for as long as it retains such personal information.
To initially self-certify or subsequently re-certify for the EU-
U.S. DPF and, as applicable, UK Extension to the EU-U.S. DPF, and/or
the Swiss-U.S. DPF, an organization must on each occasion provide to
the DOC a submission that contains the relevant information specified
in the Principles. The submission must be made via the DOC's Data
Privacy Framework program website by an individual within the
organization who is authorized to make representations on behalf of the
organization and any of its covered U.S. entities regarding its
adherence to the Principles. Such an organization must respond promptly
to inquiries and other requests for information from the DOC relating
to the organization's adherence to the Principles.
ITA has committed to follow up with organizations that have been or
wish to be removed from the Data Privacy Framework List. ITA will
direct organizations that allow their self-certifications to lapse to
verify whether they intend to re-certify or instead intend to withdraw.
An organization that intends to re-certify will be required to further
verify to the DOC that during the lapse of its certification status it
applied the Principles to relevant personal data received in reliance
on its participation in the Data Privacy Framework program and clarify
what steps it will take to address the outstanding issues that have
delayed its re-certification. An organization that intends to withdraw
will be required to further verify to the DOC what it will do and/or
has done (as applicable) with the relevant personal data that it
received in reliance on its participation in the Data Privacy Framework
program (i.e., (a) retain such data, continue to apply the Principles
to such data, and affirm to the DOC on an annual basis its commitment
to apply the Principles to such data; (b) retain such data and provide
``adequate'' protection for such data by another authorized means; or
(c) return or delete all such data by a specified date) and who within
the organization will serve as an ongoing point of contact for
Principles-related questions. Organizations will be required to provide
such verification to the DOC by completing and submitting appropriate
questionnaires to the DOC.
ITA has also committed to conduct compliance reviews on an ongoing
basis, including, as appropriate, through sending detailed
questionnaires to participating organizations. The DOC will require
that a participating organization complete and submit to the DOC such a
questionnaire when: (a) the DOC has received any specific, non-
frivolous complaints about the organization's compliance with the
Principles; (b) the organization does not respond satisfactorily to
inquiries by the DOC for information relating to the organization's
adherence to the Principles; or (c) there is credible evidence that the
organization does not comply with its commitments under the EU-U.S. DPF
and, as applicable, the UK Extension to the EU-U.S. DPF, and/or the
Swiss-U.S. DPF.
II. Method of Collection
Organizations would make their initial self-certification, as well
as annual re-certification submissions under the Data Privacy Framework
program (i.e., the EU-U.S. DPF and, as applicable, the UK Extension to
the EU-U.S. DPF, and/or the Swiss-U.S. DPF) to the DOC online via the
DOC's Data Privacy Framework program website (<a href="https://www.dataprivacyframework.gov/">https://www.dataprivacyframework.gov/</a>). An organization that already
participates in the EU-U.S. DPF and intends to extend its participation
to also cover personal data received from the United Kingdom would make
its election to participate in the UK Extension to the EU-U.S. DPF
either: (a) as part of its annual re-certification to the EU-U.S. DPF,
or (b) outside of its
[[Page 19069]]
annual re-certification to the EU-U.S. DPF provided it makes that
election no later than six months from the effective date for the UK
Extension to the EU-U.S. DPF (n.b., in either scenario the organization
would make the relevant submission to the DOC online via the DOC's Data
Privacy Framework program website). Organizations would complete and
submit Data Privacy Framework program questionnaires to the DOC online
via the DOC's Data Privacy Framework program website or via email at
<a href="/cdn-cgi/l/email-protection#c5a1b5a3ebb5b7aaa2b7a4a885b1b7a4a1a0eba2aab3"><span class="__cf_email__" data-cfemail="ef8b9f89c19f9d80889d8e82af9b9d8e8b8ac1888099">[email protected]</span></a> (as applicable) in accordance with Data Privacy
Framework program requirements.
The DOC previously requested and obtained approval of analogous
information collection that has allowed the DOC, as represented by ITA,
to collect information from organizations in the United States to
enable them to self-certify their commitment to comply with the EU-U.S.
Privacy Shield Framework Principles and/or the Swiss-U.S. Privacy
Shield Framework Principles (OMB Control No. 0625-0276). Pursuant to
the EU-U.S. DPF, the EU-U.S. Privacy Shield Framework Principles will
be amended as the ``EU-U.S. Data Privacy Framework Principles''; and
pursuant to the Swiss-U.S. DPF, the Swiss-U.S. Privacy Shield Framework
Principles will be amended as the ``Swiss-U.S. Data Privacy Framework
Principles''. Organizations that self-certified their commitment to
comply with the EU-U.S. Privacy Shield Framework Principles and/or the
Swiss-U.S. Privacy Shield Framework Principles that wish to enjoy the
benefits of participating in the EU-U.S. DPF and/or the Swiss-U.S. DPF
(as applicable) must comply with the amended Principles once those
amendments have entered into effect. More information on self-
certification, including annual re-certification under the Data Privacy
Framework program will be made available on the DOC's Data Privacy
Framework program website (<a href="https://www.dataprivacyframework.gov/">https://www.dataprivacyframework.gov/</a>) once
that is launched; however, such information will also be made
available, as appropriate, on the DOC's Privacy Shield program website
(<a href="https://www.privacyshield.gov/welcome">https://www.privacyshield.gov/welcome</a>).
III. Data
OMB Control Number: New Collection. Not yet assigned.
Form Number(s): None.
Type of Review: Regular submission, new information collection.
Affected Public: Primarily businesses or other for-profit
organizations.
Estimated Number of Respondents: 4,000.
Estimated Time per Response: 40 minutes.
Estimated Total Annual Burden Hours: 3,062.
Estimated Total Annual Cost to Public: $3,260,000.
Legal Authority: The DOC's statutory authority to foster, promote,
and develop the foreign and domestic commerce of the United States (15
U.S.C. 1512).
IV. Request for Comments
We are soliciting public comments to permit the Department/Bureau
to: (a) Evaluate whether the proposed information collection is
necessary for the proper functions of the Department, including whether
the information will have practical utility; (b) Evaluate the accuracy
of our estimate of the time and cost burden for this proposed
collection, including the validity of the methodology and assumptions
used; (c) Evaluate ways to enhance the quality, utility, and clarity of
the information to be collected; and (d) Minimize the reporting burden
on those who are to respond, including the use of automated collection
techniques or other forms of information technology.
Comments that you submit in response to this notice are a matter of
public record. We will include or summarize each comment in our request
to OMB to approve this information collection request (ICR). Before
including your address, phone number, email address, or other personal
identifying information in your comment, you should be aware that your
entire comment--including your personal identifying information--may be
made publicly available at any time. While you may ask us in your
comment to withhold your personal identifying information from public
review, we cannot guarantee that we will be able to do so.
Sheleen Dumas,
Department PRA Clearance Officer, Office of the Under Secretary for
Economic Affairs, Commerce Department.
[FR Doc. 2023-06645 Filed 3-29-23; 8:45 am]
BILLING CODE 3510-DS-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on March 30, 2023.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.